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^IN THE CLAIMS- 



To facilitate entry of the following changes, the 
Applicants have submitted herewith substitute pages 
providing all the pending claims, as they now stand, 
incorporating the changes indicated below. 

Please cancel claim 7 . 

Rewrite the following claims: 



1 (Amended) A method of processing and storing data in 

2 a computer system including processor circuitry, and a data 
1$ storage device, the method comprising the steps of: 

SI storing first and second sets of records in 

lj separate first-in, first-out data structures, respectively, 

y> on the data storage device, the first and second sets of 

y? records being of different data resolutions and 

J=S corresponding to overlapping periods of time; 

# operating the processor circuitry to receive data 

jif collected over a period of time; and 

y operating the processor circuitry to update , in 

12 parallel, at least one record in each of the stored first 

13 and second sets of records with the received data such that 

14 a previous record included in each of the first and second 

15 data structures is replaced. 

1 12. (Amended) A method of collecting and processing 

2 network traffic data, comprising the steps of: 

3 periodically collecting network traffic data from 

4 a data probe, 
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5 ^ generating a database of network traffic 

6 information from the collected network traffic data, the 

7 database comprising a plurality of network traffic data 

8 sets of differing degrees of data resolution corresponding 

9 to overlapping network traffic time periods, 

10 storing each of the plurality of network traffic data 

11 sets in a different first-in, first-out data structure 

12 wherein a limited amount of data storage space is used for 

13 each of the different first-in, first out data structures, 

14 updating, in parallel, at least one record in the 

15 different first-in, first-out data structures with the 

16 collected network traffic data, and 

17 overwriting the oldest data records in the first- 
1$ in, first-out data structure used to store one of the 

W network traffic data sets, when the limited amount of data 

g$ storage space used for said first-in, first-out data 

2J. structure is filled with records. 

fi 17. (Amended) A system for monitoring network traffic 

42 data, comprising: 

ff| a plurality of network traffic data probes for 

H collecting network traffic information; 

5 processor circuitry coupled to the network 

6 traffic probes for receiving data therefrom; and 

7 a data storage device for storing a network 

8 traffic database generated by the processor circuitry using 

9 data collected by the network traffic data probes, the data 

10 storage device including: 

11 a plurality of data structures, each data 

12 structure being a first-in, first-out data structure, each 

13 one of the plurality of data structures including network 

14 traffic data: 
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15 ' a) stored at a different resolution than the 

16 resolution at which network traffic data is stored in the 

17 other ones of the plurality of data structures; and 

18 b) corresponding to a period of time which overlaps 

19 the period of time for which network traffic data is stored 

20 in the other ones of the plurality of data structures; 

21 means for updating, in parallel, at least one record 

22 in the different first-in, first-out data structures with 

23 the collected network traffic data, and 

24 means for overwriting the oldest data records in the 

25 first-in, first-out data structure used to store one of the 

26 network traffic data sets, when the limited amount of data 

27 storage space used for said first-in, first-out data 
Jp structure is filled with records. 



REMARKS 

If the Examiner believes that there are any 
unresolved issues preventing allowance in any of the claims 
now pending in the application, the Examiner should 
telephone Ms. Janet M. Skafar, Esq. at (650) 988-0655 so 
that appropriate arrangements can be made for resolving 
such issues as expeditiously as possible. 
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What is claimed is : 

1. A method of processing and storing data in a 
computer system including processor circuitry, and a data 
storage device, the method comprising the steps of: 

storing first and second sets of records in 
separate first-in, first-out data structures, 
respectively, on the data storage device, the first and 
second sets of records being of different data 
resolutions and corresponding to overlapping periods of 
t ime ; 

operating the processor circuitry to receive 
data collected over a period of time; and 

operating the processor circuitry to update, in 
parallel, at least one record in each of the stored first 
and second sets of records with the received data such 
that a previous record included in each of the first and 
second data structures is replaced. 

2. The method of claim 1, 

wherein the first and second sets of records 
are stored in separate first-in, first-out data 
structures on the data storage device; and 

wherein the step of operating the processor 
circuitry to update at least one record in each of the 
stored first and second sets of records, includes the 
step of replacing a previous record included in each of 
the first and second data structures. 
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3. The method of claim 2 r further comprising the step 
of: 

allocating fixed amounts of storage space on 
the data storage device for storing each one of the first 
and second first-in, first-out data structures used to 
store the first and second sets of records. 

4. The method of claim 2, wherein the first set of 
records include hourly records and the second set of 
records includes daily records. 

5. The method of claim 2, further comprising the step 
of : 

periodically collecting network traffic data; 
storing the collected network traffic data in a 
buffer; and 

operating the processor circuitry to retrieve 
network traffic data from the buffer, the retrieved 
network traffic data being received by the processor 
circuitry. 

6. The method of claim 5, 

wherein the network traffic data stored in the 
buffer includes time stamp information indicating the 
period of time in which the network traffic data was 
collected; and 

wherein the step of operating the processor 
circuitry to update at least one record in each of the 



3Com-7/Con ***SUBSTITUTE CLAIMS - 3/29/01*** 

-65- 



8 stored first and second sets of records includes the step 

9 of: 

10 examining at least one time stamp included in 

11 the buffered network traffic data. 

1 8. The method of claim 5, 

2 wherein the processor circuitry includes first 

3 and second central processing units , and 

4 wherein the step of operating the processor 

5 circuitry to update at least one record in each of the 

; J3 6 stored first and second sets of records includes the step 

t(i 1 of operating the first processor to update the first set 

^ 8 of records while operating the second processor to update 

p 9 the second set of records. 

€3 1 9. The method of claim 1, 

P5 2 wherein the processor circuitry includes first 

jjf 3 and second central processing units, and 

L& 4 wherein the step of operating the processor 

5 circuitry to update at least one record in each of the 

6 stored first and second sets of records includes the step 

7 of operating the first processor to update the first set 

8 of records while operating the second processor to update 

9 the second set of records. 

1 10. The method of claim 5, wherein the computer system 

2 further includes a display device, the method further 

3 comprising the step of: 
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4 displaying data corresponding to overlapping 

5 periods of time at different resolutions on the display 

6 device. 

1 11. The method of claim 1, further comprising the step 

2 of: 

3 allocating storage space for storing the first 

4 and second sets of records in first and second first-in, 

5 first-out data structures, respectively. 

yQ 1 12. A method of collecting and processing network 

s"i 2 traffic data, comprising the steps of: 

3 periodically collecting network traffic data 

p 4 from a data probe, 

5 generating a database of network traffic 

Q 6 information from the collected network traffic data, the 

7 database comprising a plurality of network traffic data 
y 8 sets of differing degrees of data resolution 

L* 9 corresponding to overlapping network traffic time 

10 periods, 

11 storing each of the plurality of network traffic 

12 data sets in a different first-in, first-out data 

13 structure wherein a limited amount of data storage space 

14 is used for each of the different first-in, first out 

15 data structures, 

16 updating, in parallel, at least one record in the 

17 different first-in, first-out data structures with the 

18 collected network traffic data, and 
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19 overwriting the oldest data records in the 

20 first-in, first-out data structure used to store one of 

21 the network traffic data sets, when the limited amount of 

22 data storage space used for said first-in, first-out data 

23 structure is filled with records. 

1 13. The method of claim 12, wherein the differing 

2 degrees of resolution correspond to measurement time 

3 periods of different duration. 

iQ 1 14. The method of claim 12, 

if= 2 wherein the collected network traffic data 

3 includes a plurality of traffic data counter values; and 
Q 4 wherein each traffic data counter value in the 

^ = 5 collected network traffic data includes information 

D 6 corresponding to an individual monitored conversation, 

f=% 7 the step of generating a database including the step of 

^ 8 generating from the information on each different 

L& 9 monitored conversation, a different record in each set of 

10 the plurality of network traffic data sets. 

1 15. The method of claim 14, further comprising the step 

2 of storing each of the plurality of network traffic data 

3 sets in a different first-in, first-out data structure. 



1 

2 



16. The method of claim 15, wherein a limited amount of 
data storage space is used for each of the different 
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first-in, first out data structures, the method further 
comprising the step of: 

overwriting the oldest data records in the 
first-in, first-out data structure used to store one of 
the network traffic data sets, when the limited amount of 
data storage space used for said first-in, first-out data 
structure is filled with records. 

17. A system for monitoring network traffic data, 
comprising : 

a plurality of network traffic data probes for 
collecting network traffic information; 

processor circuitry coupled to the network 
traffic probes for receiving data therefrom; and 

a data storage device for storing a network 
traffic database generated by the processor circuitry 
using data collected by the network traffic data probes, 
the data storage device including: 

a plurality of data structures, each data 
structure being a first-in, first-out data structure, 
each one of the plurality of data structures including 
network traffic data : 

a) stored at a different resolution than the 
resolution at which network traffic data is stored in the 
other ones of the plurality of data structures; and 

b) corresponding to a period of time which overlaps 
the period of time for which network traffic data is 
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stored in the other ones of the plurality of data 
structures ; 

means for updating,, in parallel, at least one record 
in the different first-in, first-out data structures with 
the collected network traffic data, and 

means for overwriting the oldest data records in the 
first-in, first-out data structure used to store one of 
the network traffic data sets, when the limited amount of 
data storage space used for said first-in, first-out data 
structure is filled with records. 

18. The system of claim 17, wherein each of the 
plurality of data structures is a first-in, first-out 
data structure. 

19. The system of claim 18, wherein each one of the 
plurality of data structures includes a plurality of data 
records, each data record corresponding to a monitored 
network conversation . 

20. The system of claim 18, wherein data records are 
arranged within each individual data structure as a 
function of the time the conversation to which the record 
corresponds was monitored. 

21. The system of claim 20, wherein records which were 
monitored during the same time interval are grouped 
together within each individual data structure. 
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1 22. The system of claim 21, further comprising: 

2 means for modifying at least one network 

3 traffic data record included in each one of the plurality 

4 of data structures to reflect collected information about 

5 an individual network conversation. 



1 23. The system of claim 18, further comprising: 

2 means for modifying at least one network 

3 traffic data record included in each one of the plurality 

4 of data structures to reflect collected information about 
*p 5 an individual network conversation. 

1 24. The system of claim 18, wherein the processor 

O 2 circuitry includes a plurality of separate central 

7" 3 processing units which operate in parallel. 

q 1 25. The system of claim 24, wherein each one of the 

IJ 2 plurality of data structures includes a plurality of data 

H= 3 records, each data record corresponding to a monitored 

4 network conversation. 



1 26. The system of claim 24, wherein data records are 

2 arranged within each individual data structure as a 

3 function of the time the conversation to which the record 

4 corresponds was monitored. 
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1 27. The system of claim 26, wherein records which were 

2 monitored during the same time interval are grouped 

3 together within each individual data structure. 

1 28. The system of claim 27, further comprising: 

2 means for modifying at least one network 

3 traffic data record included in each one of the plurality 

4 of data structures to reflect collected information about 

5 an individual network conversation. 

yQ 1 29. The system of claim 24, further comprising: 

2 means for modifying at least one network 

5^4 3 traffic data record included in each one of the plurality 

O 4 of data structures to reflect collected information about 

5 an individual network conversation. 
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